PRIVACY POLICY

INFORMATION ON DATA PROCESSING PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679 (“GDPR”)

Given that: (i) https://www.b-ticket.com is a service offered by the temporary joint venture founded through act No. 20617 (repertoire), No. 6713 (collection), of which Giunti Editore S.p.A. is the commissioner/group leader, with registered office in Via G. B. Pirelli, 30, 20124 Milan, Italian fiscal code and registration number in the Milan Register of Companies: 80009810484, share capital €8,000,000.00 fully deposited; (ii) the companies in the temporary business association are joint holders, pursuant to art. 26 of EU Regulation 2016/679 (hereinafter also referred to as ‘GDPR’) of the processing of personal data of the users of the website for the purposes laid out in this information sheet and specific to the temporary business partnership; (iii) the companies in the temporary business partnership responsible for the satisfaction of the requirements stated above have signed an appropriate joint ownership agreement (art. 26 GDPR); (iv) the members of the temporary association of companies that do not process the personal data of the parties concerned (users) do not come into contact with any of the personal data of the parties concerned, and for this reason do not have any privacy role; (v) pursuant to the provisions of current legislation on the protection of personal data, with particular reference to Article 13 of EU Regulation 2016/679, the companies composing the joint venture (Giunti Editore SpA, Opera Laboratori Fiorentini SpA, Orbital Cultura srl, a Nexi group company) inform the parties concerned (site users) of the following:

1. Purposes of processing and data processed, legal basis and need for conferral.

The contracting companies will process the acquired data for the following purposes:

· for the fulfilment of contractual obligations (e.g. the purchase of products via the website, ticket booking and payment as well as website registration for associated services). Such processing involves categories of common user data (name, surname, contact details for order confirmation, shipping address, tax data for invoicing). The legal basis of the processing is the need to fulfil the obligations arising from contract art. 6 paragraph 1 letter b) of the GDPR; while the provision of the data requested is necessary to honour the contract between the parties, and the data requested are thus pertinent and strictly necessary;

· for the issue of invoices and any relative administrative-accounting requirements. The processing involves categories of common user data (name, surname, address data for order confirmation, shipping address, tax data for invoicing); the legal basis of the processing is the need to fulfil the obligations arising from the contract Article 6 paragraph 1 letter b) of the GDPR. The provision of the data requested is necessary to execute the contract between the parties, and the data requested are thus pertinent and strictly necessary;

· to correctly fulfil the obligations deriving from laws or regulations in force (for example in the fiscal field such as the conservation of invoices, etc.). The processing involves categories of common user data (name, surname, address data for order confirmation, shipping address, fiscal data for invoicing). The legal basis of the processing is the need to fulfil obligations deriving from the contract, art. 6, paragraph 1, letter c) of the GDPR; the conferment of the data requested is necessary to execute the contract between parties, and the data requested are thus pertinent and strictly necessary;

· to receive promotional communications, including the carrying out of market research or surveying the degree of customer satisfaction on the quality of services rendered and the activities carried out by the temporary joint venture. The legal basis of the processing is the consent of the data subject (article 6, paragraph 1, letter a) of the GDPR) which may be revoked at any time by the data subject.

2. Categories of persons to whom data may be communicated

The personal data of the data subjects may be processed by the staff (employees and/or collaborators) of the temporary partnership companies for the purposes stated in this information sheet, subject to training and assignment to confidentiality pursuant to Articles 29 of the GDPR and 2-quaterdecies of Legislative Decree 196/2003, as amended and adapted to the GDPR by Legislative Decree 101/2018.
The personal data of the parties concerned may also be communicated to subjects operating as autonomous data controllers, on the basis of legal provisions (including, by way of example, authorities and supervisory and control bodies and in general subjects, public or private, entitled to request the data) or to subjects appointed as data controllers pursuant to Article 28 of the GDPR. The complete list of data processors will be made available to the data subject upon request at the addresses below in the ‘contact details’ section.
The personal data of the parties concerned, as well as any other information associated with them, directly or indirectly, will be processed by applying technical, organisational and safety measures so as to ensure a level of security appropriate to the risk, taking into account the state of the art and the costs of implementation, in accordance with the provisions of current legislation on personal data, as well as in compliance with the provisions of the Guarantor Authority and within the limits of the provisions of Article 5 of the GDPR.

3. Transferral of data to countries outside the EU

In pursuit of the purposes indicated, the contracting companies will not transfer personal data to countries outside the EU, in accordance with the GDPR. If it is necessary to carry out a transfer, all due precautions and security measures for the protection of personal data shall be adopted, as foreseen in Chapter V of EU Regulation 2016/679.

4. Period of data conservation

Personal data will be kept only for the time necessary to guarantee the correct provision of the services offered and, if necessary, until the fulfilment of legal obligations and those deriving from contractual relations (the data will be kept according to the provisions of the tax and administrative law for 10 years) has been completed, except in the case of events interrupting the foreseen period. Where the legal basis is that of consent, processing may be carried out up until its revocation.

5. Rights of the data subjects

In relation to the processing operations described above, data subjects may at any time exercise the rights provided for by the GDPR (ex-Articles 15 to 22): Articles. 15 – “The data subject’s right of access,” 16 – “Right to rectification,” 17 – “Right to erasure,” 18 – “Right to restriction of processing,” 19 – “Obligation to notify in case of rectification or erasure of personal data or restriction of processing,” 20 – “Right to data portability,” 21 – “Right to object,” 22 – “Automated decision-making process concerning natural persons, including profiling” of the GDPR, within the limits and under the conditions foreseen by Art. 12 of the GDPR and to lodge a complaint pursuant to Article 77 if deemed appropriate.
The contracting companies state that requests for the exercise of rights may be sent by email to the following address: dpo@nexigroup.com and the addresses given in the paragraph below.

6. Contact details of the contracting companies

The contracting companies will receive any privacy requests inherent to the website in question at the following addresses:
Orbital Cultura Srl, with registered office in Florence, Via Petrocchi 24. The designated Data Protection Officer may be contacted by writing to the following email address: dpo@nexigroup.com.

COOKIE POLICY

This page outlines the cookies used on the website of “b-ticket.com”, with reference to the processing of personal data of users who consult it.

This information is provided pursuant to current privacy legislation, the provisions of art. 13 of EU Regulation 2016/679 of 27 April 2016 and the provisions of the Privacy Guarantor of 8 May 2014 on the management and use of cookies. It is addressed to those who interact with the web services of ATI Giunti, which can be accessed electronically from the address: https://www.b-ticket.com/.

The information is provided only for this website and not for other websites that may be consulted by the user through other links.

WHAT ARE COOKIES?

Cookies are small text files that the sites visited send to the user’s browser, where they are stored and then transmitted to the same sites the next time the user visits. In this way the website or server recognises the browser and remembers the preferences expressed by the user, together with other useful information to facilitate his/her navigation.

Cookies differ from each other on the basis of the purposes of the user.

FIRST AND THIRD-PARTY COOKIES
Depending on the specific entity that installs cookies on the user’s terminal, cookies may be divided into:

· first-party cookies: set by the sites themselves (with the same domain as that indicated in the browser address bar) and can only be read by these sites;

· third-party cookies: set by domains other than that indicated in the browser address bar, i.e. by organisations that do not correspond to the owners of the websites. These cookies are used, for example, to collect information for advertising purposes and to personalise content, as well as to track visits to the site.

TECHNICAL AND PROFILING COOKIES
Cookies can also be divided into:

· technical cookies: essential for the correct functioning of a website or application. Without this type of cookie, the site may not function properly or may prevent some functions altogether. The installation of such cookies does not require the prior consent of the users.

· profiling cookies: these are used to collect and store information about the visitor (e.g. pages visited, searches made, etc.) in order to be able to offer advertising messages that are more targeted and in line with the user’s interests. The consent of the person concerned is required for the use of profiling cookies. In the case of third-party cookies, the site has no direct control over the individual cookies and cannot manage them (i.e. it cannot directly install or delete them). The user can however manage these cookies through the settings of the browser (see the section “How to delete cookies from your computer”), or the sites listed in the section “How to block third-party cookies”.

TEMPORARY or PERMANENT COOKIES

Cookies have a duration dictated by the expiration date (or a specific action such as closing the browser) set at the time of installation. Cookies can be classified as follows:

· temporary or session cookies: are stored temporarily in your computer’s memory while you visit a site (e.g. to keep track of the language selected). Session cookies are stored for a short period of time and deleted when you close your browser;

· persistent cookies: remain on your computer for a long period of time, depending on the expiry date set when the cookie is generated. These cookies allow websites to keep information in the memory even during subsequent visits by the user, for example thus avoiding having to enter your login credentials again.

TYPES OF COOKIES USED BY THIS SITE

The present site uses the following cookies:

· navigation/session cookies: essential to navigate the site using all its features. Without these cookies it would not be possible to provide the requested services. These cookies do not collect information to be used for commercial purposes;

· analytical third party cookies: they collect and analyse anonymous and/or aggregate information on visitors’ use of the site (pages visited, etc.) to provide the user with a better navigation experience. These cookies do not collect information that can identify the user in any way;

For further information on third-party cookies, and how to oppose such cookies, please refer to the information of their owners below.

· Google Analytics (Google Ireland Limited): Google Analytics è un servizio di analisi web fornito da Google Ireland Limited (“Google”). Google utilizza i Dati Personali raccolti allo scopo di tracciare ed esaminare l’utilizzo di questa Applicazione, compilare report e condividerli con gli altri servizi sviluppati da Google. Google potrebbe utilizzare i Dati Personali per contestualizzare e personalizzare gli annunci del proprio network pubblicitario.

· Google Tag Manager (Google Ireland Limited): Google Tag Manager è un servizio di gestione dei tag fornito da Google Ireland Limited

· Font Awesome (Fonticons, Inc. ): Font Awesome è un servizio di visualizzazione di stili di carattere gestito da Fonticons, Inc. che permette a questa Applicazione di integrare tali contenuti all’interno delle proprie pagine.

· Google Fonts (Google Ireland Limited): Google Fonts è un servizio di visualizzazione di stili di carattere gestito da Google Ireland Limited che permette a questa Applicazione di integrare tali contenuti all’interno delle proprie pagine.

HOW TO BLOCK COOKIES FROM YOUR COMPUTER

You can restrict or block cookies by altering your browser settings.

Below are the links that contain instructions on how to remove cookies already installed on your computer for the most popular browsers.

· Mozilla Firefox: for more information visit the specific page

· Microsoft Internet Explorer: for more information visit the specific page

· Chrome: for more information visit the specific page

· Opera: for more information visit the specific page

· Safari iOS: for more information visit the specific page

Disabling some cookies may limit the functionality of the site.